CVE-2026-79793 is a cross-site scripting (XSS) vulnerability in code-projects Online Shopping System version 1.0. The vulnerability exists in the /admin/sumit_form.php file where manipulation of the 'Success' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. The CVSS score is 5.3, indicating a medium severity level.
This report discusses a category of risky websites that browsers often mistakenly classify as safe. These 'gray-area' sites are not outright phishing scams but are untrustworthy and may cause financial loss or data compromise. Examples include subscription aggregators with hidden costly renewals, scam online stores selling counterfeit or non-existent goods while harvesting personal and payment data, fraudulent crypto trading platforms that steal investments and credentials, deceptive middleman services charging excessive fees, and fake browser extensions that hijack browsing data and sessions. These sites often exploit legal loopholes or obscure terms to avoid direct illegality. Users are advised to be cautious even when browsers show no warnings, especially with suspicious payment methods or requests for sensitive information.
The WP Courses LMS plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.2.29. This flaw allows authenticated users with custom-level access or higher to read other users' quiz answers and scores by manipulating the 'resultID' parameter in an AJAX request. The vulnerability arises from missing validation on a user-controlled key and insufficient access control, relying only on a nonce check that is exposed to all logged-in users.
The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over alleged violations of the Children's Online Privacy Protection Act (COPPA). The allegations include allowing children under 13 to create regular accounts outside of restricted modes, collecting and retaining their personal data without parental consent, and failing to delete such data upon request. The settlement resolves these allegations without a judicial determination of liability. TikTok has reportedly made significant changes to its data management and compliance practices since 2024.
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
CVE-2026-78248 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It affects an unknown function in the file /fos/admin/ajax.php when handling the 'Name' argument. The vulnerability allows remote attackers to manipulate SQL queries. The exploit has been publicly disclosed but there are no known exploits in the wild. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
CVE-2026-78247 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It arises from improper handling of the 'ID' parameter in the /fos/admin/ajax.php?action=confirm_order endpoint. This vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The vulnerability has a medium severity rating with a CVSS score of 6.9. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently provided.
CVE-2026-78246 is a SQL injection vulnerability in itsourcecode Online Clinic Management System version 1.0. The flaw exists in the Admin Login component, specifically in the success/login.php file, where manipulation of the Username argument allows SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-78245 is a medium severity vulnerability in itsourcecode Online Pharmacy System 1.0. It involves an unrestricted file upload flaw in the move_uploaded_file function within the User Registration component (all_users/register.php). This vulnerability allows remote attackers to manipulate the photo argument to upload arbitrary files. An exploit has been published, but no known active exploitation in the wild is reported.
CVE-2026-78199 is a medium severity SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/view_prod.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.
CVE-2026-78198 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the processing of the 'pid' parameter in the /fos/admin/ajax.php?action=add_to_cart endpoint. This flaw allows remote attackers to manipulate SQL queries via the 'pid' argument. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed. No official patch or remediation information is provided.
CVE-2026-78197 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/admin/ajax.php?action=save_user endpoint, where manipulation of the Username parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.
This content discusses the challenges of maintaining online privacy in an environment dominated by surveillance capitalism, where data brokers aggregate personal information to create detailed profiles. It explains how using a single set of identifiers (email, phone number, payment method) across online activities facilitates profiling and increases exposure to breaches, spam, and identity theft. The article promotes the use of multiple digital personas to compartmentalize online identities, thereby limiting correlation and reducing privacy risks. The solution presented is MySudo, an application that enables users to create separate digital identities with distinct contact and payment details to protect personal information.
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.